Add reusable betterleaks secrets scan workflow (default rules)

[Cavonstavant]

Summary

Adds betterleaks-scan-public.yaml, a reusable (workflow_call) secrets scan for pull requests, modeled on Secu.Actions' betterleaks-required-check.yml but adapted for public repositories with external contributors:

• Runs betterleaks with its built-in default rules — no custom betterleaks.toml, no GitHub App token, no internal Lucca integrations (no Slack notifications, no internal runners/containers).
• Scans the patches of the commits introduced by the PR (base..HEAD range), so a secret added then removed within the PR is still caught. Falls back to a full-history scan when the calling event has no base SHA.
• Installs betterleaks from the official release (default v1.8.1, overridable via the betterleaks-version input), verified with gh release verify, sha256 checksums, and gh release verify-asset.
• Emits inline GitHub annotations and fails the check while any secret is present in the range.
• Maintains a single auto-updated PR comment (marker-based, updated in place instead of stacking one per run) with per-commit permalinks, interactive-rebase remediation steps, and rotation guidance. No actions/cache usage, avoiding a cache-poisoning surface on fork PRs.
• Actions SHA-pinned, github-context values passed via env, persist-credentials: false; the file is clean under zizmor's full auditor persona.

Usage

name: Betterleaks Secrets Scanning
on:
  pull_request:
  merge_group:
jobs:
  secrets-scan:
    uses: LuccaSA/PublicWorkflows/.github/workflows/betterleaks-scan-public.yaml@main
    permissions:
      contents: read
      pull-requests: write

Test plan

• zizmor 1.23.1 full auditor persona: no findings
• Local run of betterleaks git --log-opts base..HEAD on a test repo: a fake GitHub PAT committed then deleted in a later commit is caught, with repo-relative File and populated Commit fields as the annotation/comment logic expects
• Verified betterleaks/betterleaks v1.8.1 release assets match the install step's naming (betterleaks_1.8.1_linux_x64.tar.gz, checksums.txt)
• Call the workflow from a sandbox public repo PR containing a test secret and confirm annotations, failing check, and the auto-updated comment

🤖 Generated with Claude Code